linuxhound 0.3.1

Evidence-backed Linux permission graphs and attack-path investigation.
Trace how accounts reach privileged resources, inspect the supporting evidence and compare permission paths before and after hardening changes.

Documentation · Quick start · Docker · GNN · Releases · Issues

Live collection: Linux only. macOS, BSD and Windows are not collection targets. Saved HTML reports open in a modern desktop browser. The demo can run elsewhere with Python; it does not audit that operating system.

The graph above comes from the LinuxHound demo. Red relationships mark modeled trust boundaries, while dashed relationships retain unresolved prerequisites. Following a connection helps explain access, but does not establish that an exploit works.

Quick start: Linux

To begin on a Linux host with Git and Python 3.9 or newer, clone the repository and enter its directory. Then create a virtual environment, install LinuxHound and run your first collection:

git clone https://github.com/daniyyell-dev/LinuxHound.git
cd LinuxHound
python3 -m venv .venv
. .venv/bin/activate
python -m pip install .
linuxhound scan --root /etc --root /opt --serve --open

When collection finishes, LinuxHound feeds the results directly into the UI. Each run saves snapshot.json, report.json and index.html under linuxhound-results/. --serve --open opens a localhost viewer. On a headless host, omit those flags and copy the HTML to a trusted desktop. For installation from the Python Package Index, use python -m pip install linuxhound, or python -m pip install 'linuxhound[gnn]' to include the optional neural dependencies.

If you want to explore the interface first, open the demo without collecting information from a host:

linuxhound demo --open

Once you are familiar with the graph, you can install the optional Graph Neural Network (GNN) dependencies and explore neural review ordering:

python -m pip install '.[gnn]'
linuxhound demo --gnn --open

The bundled model is an uncalibrated synthetic demonstration. Its scores help order reviews; they do not prove vulnerabilities or safety. Missing collection coverage is not a clean result.

Compare Linux tools

LinuxHound is a better fit when you need to follow permissions across accounts, inspect a path's evidence in a browser and review what changed after hardening. The tools below serve different workflows, so the comparison includes strengths that LinuxHound does not provide.

Documentation

Continue with the user guide for investigating results, graph examples and model training. It also covers comparison details, collection scope and limitations, and development.

References and acknowledgements

BloodHound inspired the relationship graph and attack-path investigation approach. LinuxHound also provides an export for BloodHound's OpenGraph framework.

GTFOBins provides the Unix executable reference used by LinuxHound's optional technique matching. Catalog matches provide context for reviewing permissions; they do not establish that a path is exploitable.

LinuxHound is licensed under Apache-2.0. Attribution information is available in NOTICE.